<?php
/**
 * One-click connect. The owner presses "Connect to PostaraMail", approves on
 * postaramail.com (already logged in), and comes back connected: no API key
 * to copy. The key travels server-to-server, never through the address bar.
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class PostaraMail_Connect {

	public static function init() {
		add_action( 'admin_post_postaramail_connect', array( __CLASS__, 'start' ) );
		add_action( 'admin_post_postaramail_disconnect', array( __CLASS__, 'disconnect' ) );
		add_action( 'admin_init', array( __CLASS__, 'maybe_finish' ) );
	}

	public static function connected() {
		return PostaraMail_API::configured();
	}

	public static function info() {
		$i = get_option( 'postaramail_connection', array() );
		return is_array( $i ) ? $i : array();
	}

	/** Sends the owner to PostaraMail to approve the connection. */
	public static function start() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Not allowed.', 'postaramail' ), '', array( 'response' => 403 ) );
		}
		check_admin_referer( 'postaramail_connect' );

		$state = wp_generate_password( 24, false, false );
		set_transient( 'postaramail_state_' . get_current_user_id(), $state, 15 * MINUTE_IN_SECONDS );

		$url = add_query_arg(
			array(
				'site'   => untrailingslashit( home_url() ),
				'name'   => wp_strip_all_tags( get_bloginfo( 'name' ) ),
				'return' => admin_url( 'admin.php?page=postaramail' ),
				'state'  => $state,
			),
			PostaraMail_API::base() . '/connect/wordpress'
		);
		wp_redirect( $url ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- deliberate: PostaraMail approval screen.
		exit;
	}

	/** Back from PostaraMail with ?pm_code=… (or ?pm_error=denied). */
	public static function maybe_finish() {
		if ( ! isset( $_GET['page'] ) || 'postaramail' !== $_GET['page'] || ( ! isset( $_GET['pm_code'] ) && ! isset( $_GET['pm_error'] ) ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			return;
		}
		if ( ! current_user_can( 'manage_options' ) ) {
			return;
		}

		$back  = admin_url( 'admin.php?page=postaramail' );
		$key   = 'postaramail_state_' . get_current_user_id();
		$saved = get_transient( $key );
		$state = isset( $_GET['pm_state'] ) ? sanitize_text_field( wp_unslash( $_GET['pm_state'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		delete_transient( $key ); // One try per click.

		if ( ! $saved || ! hash_equals( (string) $saved, $state ) ) {
			wp_safe_redirect( add_query_arg( 'pm_msg', 'state', $back ) );
			exit;
		}
		if ( isset( $_GET['pm_error'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			wp_safe_redirect( add_query_arg( 'pm_msg', 'denied', $back ) );
			exit;
		}

		$code = sanitize_text_field( wp_unslash( $_GET['pm_code'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$r    = PostaraMail_API::exchange( $code );
		if ( ! $r['ok'] ) {
			set_transient( 'postaramail_connect_error', $r['message'], 120 );
			wp_safe_redirect( add_query_arg( 'pm_msg', 'failed', $back ) );
			exit;
		}

		update_option( 'postaramail_api_key', $r['data']['key'], false );
		update_option(
			'postaramail_connection',
			array(
				'via'       => 'connect',
				'workspace' => isset( $r['data']['workspace']['name'] ) ? $r['data']['workspace']['name'] : '',
				'time'      => time(),
			),
			false
		);
		delete_transient( 'postaramail_me' );
		delete_transient( 'postaramail_automations' );
		wp_safe_redirect(
			add_query_arg(
				array(
					'tab'    => 'sync',
					'pm_msg' => 'connected',
				),
				$back
			)
		);
		exit;
	}

	public static function disconnect() {
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_die( esc_html__( 'Not allowed.', 'postaramail' ), '', array( 'response' => 403 ) );
		}
		check_admin_referer( 'postaramail_disconnect' );
		$info = self::info();
		if ( isset( $info['via'] ) && 'connect' === $info['via'] && PostaraMail_API::configured() ) {
			PostaraMail_API::disconnect(); // Revoke on PostaraMail too (best effort).
		}
		delete_option( 'postaramail_api_key' );
		delete_option( 'postaramail_connection' );
		delete_transient( 'postaramail_me' );
		delete_transient( 'postaramail_automations' );
		wp_safe_redirect( admin_url( 'admin.php?page=postaramail&pm_msg=disconnected' ) );
		exit;
	}
}